SFTPGo: Denial of service via malformed SSH channel request

中 6.5CVE-2026-77375 · GHSA-q7pc-356p-hggc · GO-2026-6792 · 13/10/2026 公開 · 13/10/2026 更新

要点

CVE-2026-77375 は github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.31%（全脆弱性の 23.7% より高い）。
対処：2.7.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/drakkan/sftpgo Go	`全バージョン`	修正版なし
github.com/drakkan/sftpgo/v2 Go	`< 2.7.5`	`2.7.5`

概要

Summary

A flaw in the SSH service allows an authenticated client to crash the server by sending a malformed protocol message while opening a channel.

Impact

Any user able to authenticate over SSH can trigger an unhandled error condition that aborts the server process. This results in a denial of service affecting all connected users until the service is restarted. No confidentiality or integrity impact has been identified; the issue is limited to availability.

NVD の説明

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.